CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,959 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
149,714 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-1119 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and S… | Patch early | 10.0 high | 19.4% | 2010-03-25 |
| CVE-2002-0379 EXP | Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 sup… | Patch early | 7.5 high | 19.4% | 2002-06-25 |
| CVE-2007-2057 EXP | Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 allows remote attackers to execute arbitrary code via crafted 802.11 authentication packets… | Patch early | 10.0 high | 19.4% | 2007-04-18 |
| CVE-2002-1183 EXP | Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute cod… | Patch early | 7.5 high | 19.3% | 2002-12-11 |
| CVE-2017-7285 EXP | A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all avai… | Patch early | 7.5 high | 19.3% | 2017-03-29 |
| CVE-2001-0247 EXP | Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as… | Patch early | 10.0 high | 19.3% | 2001-06-18 |
| CVE-2019-18634 EXP | In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfe… | Patch early | 7.8 high | 19.3% | 2020-01-29 |
| CVE-2018-15139 EXP | Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to exec… | Patch early | 8.8 high | 19.3% | 2018-08-13 |
| CVE-2019-9017 EXP | DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name. | Patch early | 7.5 high | 19.2% | 2019-05-02 |
| CVE-2018-1000888 EXP | PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with… | Patch early | 8.8 high | 19.1% | 2018-12-28 |
| CVE-2020-6507 EXP | Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Patch early | 8.8 high | 19.1% | 2020-07-22 |
| CVE-1999-0450 EXP | In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe). | Patch early | 7.5 high | 19% | 1999-01-26 |
| CVE-2017-14627 EXP | Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INFORMATION t… | Patch early | 7.8 high | 19% | 2017-09-23 |
| CVE-2013-5967 EXP | Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attackers to exe… | Patch early | 7.5 high | 19% | 2013-10-09 |
| CVE-2003-0172 EXP | Buffer overflow in openlog function for PHP 4.3.1 on Windows operating system, and possibly other OSes, allows remote attackers to cause a crash and p… | Patch early | 7.5 high | 19% | 2003-04-02 |
| CVE-2018-17408 EXP | Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CS… | Patch early | 7.8 high | 19% | 2018-10-03 |
| CVE-2019-12735 EXP | getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeli… | Patch early | 8.6 high | 19% | 2019-06-05 |
| CVE-2004-1096 EXP | Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via… | Patch early | 7.5 high | 19% | 2005-01-10 |
| CVE-2011-0020 EXP | Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when th… | Patch early | 7.6 high | 18.9% | 2011-01-24 |
| CVE-2018-20556 EXP | SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_i… | Patch early | 8.8 high | 18.9% | 2019-03-21 |
| CVE-2006-6059 EXP | Buffer overflow in MA521nd5.SYS driver 5.148.724.2003 for NetGear MA521 PCMCIA adapter allows remote attackers to execute arbitrary code via (1) beaco… | Patch early | 10.0 high | 18.9% | 2006-11-22 |
| CVE-2007-2194 EXP | Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long sectio… | Patch early | 10.0 high | 18.9% | 2007-04-24 |
| CVE-2016-6855 EXP | Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attacke… | Patch early | 7.5 high | 18.9% | 2016-09-07 |
| CVE-2010-1980 EXP | Directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to i… | Patch early | 7.5 high | 18.8% | 2010-05-19 |
| CVE-2014-10037 EXP | Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url paramete… | Patch early | 7.5 high | 18.8% | 2015-01-13 |
| CVE-2007-1285 EXP | The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) v… | Patch early | 7.5 high | 18.8% | 2007-03-06 |
| CVE-2004-0771 EXP | Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command… | Patch early | 10.0 high | 18.8% | 2004-11-23 |
| CVE-2010-4597 EXP | Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control in igcomm.dll in Ecava IntegraXor Human-Machine Interface (HM… | Patch early | 10.0 high | 18.8% | 2010-12-23 |
| CVE-2010-1983 EXP | Directory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows remote attackers to read arbi… | Patch early | 7.5 high | 18.8% | 2010-05-19 |
| CVE-2008-1391 EXP | Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attac… | Patch early | 7.5 high | 18.8% | 2008-03-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt